Detections
Analytics

3.10 Ensure global .NET trust level is configured - Applications

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This only applies to .Net 2.0. Future versions have stopped supporting this feature.
 An application's trust level determines the permissions that are granted by the ASP.NET code access security (CAS) policy. CAS defines two trust categories: full trust and partial trust. An application that has full trust permissions may access all resource types on a server and perform privileged operations, while applications that run with partial trust have varying levels of operating permissions and access to resources.
 The possible values for the Level property of the TrustSection class are:
 * Full: Specifies unrestricted permissions and grants the ASP.NET application permissions to access any resource that is subject to operating system security; all privileged operations are supported
 * High: specifies a high level of code access security which limits the application from doing the following:
 o Call unmanaged code
 o Call serviced components
 o Write to the event log
 o Access Microsoft Windows Message Queuing queues
 o Access ODBC, OLD DB, or Oracle data sources
 * Medium: specifies a medium level of code access security, which means that in addition to the restrictions for High, the ASP.NET application cannot do any of the following things:
 o Access files outside the application directory
 o Access the registry
 * Low: specifies a low level of code access security, which means that in addition to the restrictions for Medium, the application is prevented from performing any of the following actions:
 o Write to the file system
 o Call the System.Security.CodeAccessPermission.Assert method to expand permissions to resources
 o Minimal: specifies a minimal level of code access security, which means that the application has only execute permission
 It is recommended that the global .NET Trust Level be set to Medium or lower.

 Rationale:
 The CAS determines the permissions that are granted to the application on the server. Setting a minimal level of trust that is compatible with the applications will limit the potential harm that a compromised application could cause to a system.

Solution

Trust level can be set by using the UI, running appcmd.exe commands, by editing configuration files directly, or by writing WMI scripts. To set the .Net Trust Level to Medium at the server level using an appcmd.exe command:
 %systemroot%\system32\inetsrv\appcmd set config /commit:WEBROOT /section:trust /level:Medium
 When Appcmd.exe is used to configure the element at the global level in IIS, the /commit:WEBROOT switch must be included so that configuration changes are made to the root web.config file instead of ApplicationHost.config.
 Default Value:
 By default, ASP.NET web applications run under the full trust setting.

See Also

https://workbench.cisecurity.org/files/2220

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6, CSCv7|14.6

Plugin: Windows

Control ID: 96b2b98afec42ded3e17ea2f46d690d64ba6b2b8c521ce6f476def2b5c94c3ae